macOS 15 CIS Benchmarks: add 2.6.3.1 through 2.6.3.5 & 2.7.2

[noahtalerman]

Goal

User story
As an endpoint engineer,
I want Fleet to support the 2.6.3.5 & 2.7.2 macOS 15 CIS Benchmarks
so that I can check whether my workstations meet these compliance needs.

Key result

None. Fleet is committed to maintaining CIS Benchmarks for Windows and Mac workstations.

Original requests

#23006

Context

• Product designer: @noahtalerman

Changes

Product

• CIS policies changes: Add policies for macOS 15 to cover 2.6.3.1 through 2.6.3.5 & 2.7.2
• Feature guide changes: No changes
• Other reference documentation changes:
  • Remove 2.6.3.1 through 2.6.3.5 & 2.7.2 from the "Missing items" list in the macOS 15 README
• UI changes: No changes
• CLI (fleetctl) usage changes: No changes
• YAML changes: No changes
• REST API changes: No changes
• Activity changes: No changes
• Permissions changes: No changes
• Changes to paid features or tiers: Fleet Premium only
• Other reference documentation changes: No changes
• Once shipped, requester has been notified
• Once shipped, dogfooding issue has been filed

Engineering

• Fleet's agent (fleetd) changes: No
• Database schema migrations: No
• Load testing: No

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

Risk assessment

• Requires load testing: No
• Risk level: Low / High Low
• Risk description: Policy yml changes that do not affect the agent or server. Potential bugs in the queries themselves.

Manual testing steps

1. Step 1
2. Step 2
3. Step 3

Testing notes

Confirmation

1. Engineer (@____): Added comment to user story confirming successful completion of QA.
2. QA (@____): Added comment to user story confirming successful completion of QA.

[noahtalerman]

Engineering

• Fleet's agent (fleetd) changes: TO-DO
• Database schema migrations: TO-DO
• Load testing: TO-DO

@sharon-fdm can you please fill out the TO-DOs in the "Engineering" section in the issue description? If there are no changes please put "No changes"

I think you mentioned that adding these benchmarks will require fleetd changes. Can you please work with Josh specify those so the rest of the team knows what's changing? Thanks!

Edit by Sharon: added '-' so the TO-DO do not appear is search.